AI Credential File Access (IronWorm)

nomit vyas@xoxo

•updated Jun 22, 2026•2•0•14

Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.